<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8">
        <title>
            
            Argument Injection Vectors
        </title>
        <link rel="icon" href="/argument-injection-vectors/assets/logo.png">
        <link rel="stylesheet" href="/argument-injection-vectors/assets/style.css" type="text/css"/>
        <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, user-scalable=yes">
    </head>
    <body>
        <h1>
    
    Argument Injection Vectors ✨
</h1>


<p>A curated list of exploitable options when dealing with argument injection bugs!</p>

<p>Vectors listed below are not vulnerabilities in the associated programs but rather intended features that were proven to be useful to attackers in very specific scenarios. Please don’t report or request CVEs for them.</p>

<p>If you would like to know more on this topic, you can visit:</p>

<ul>
  <li><a href="/argument-injection-vectors/explained/">Argument Injections Explained</a></li>
  <li><a href="/argument-injection-vectors/tools/">Tools</a></li>
  <li><a href="/argument-injection-vectors/remediation/">Remediation</a></li>
</ul>

<p><strong>What’s the difference with GTFOBins?</strong></p>

<p>GTFOBins’ goal is to “bypass local security restrictions in misconfigured systems”, and that’s not what we’re trying to achieve with our project. We want to provide a list dedicated to helping vulnerability researchers to exploit argument injection bugs.</p>

<p>While some content from the two projects may overlap (i.e., when a sudoer rule allows arbitrary parameters on a command), having a separate list dedicated to these vectors is also more efficient. Users spend less time filtering out vectors that won’t apply in their case and get access to similar public advisories and write-ups.</p>

<p><strong>Contributing</strong></p>

<p><a href="/argument-injection-vectors/contributing/">Contributions</a> to this list are very welcome. Feel free to open issues <a href="https://github.com/SonarSource/argument-injection-vectors">on the repository</a> if you would like to see payloads on a specific program, or a pull request if you are already aware of exploitable flags in a target. Links to public write-ups are appreciated when adding a payload.</p>

<p>The code of this website is based on <a href="https://gtfobins.github.io/">GTFObins</a> and is released under GNU General Public License v3.0.</p>

<p>The project is maintained by the <a href="https://twitter.com/Sonar_Research">Sonar R&amp;D</a> team. Find argument injection vulnerabilities in your code (and much more) with 
<a href="https://sonarcloud.io/">SonarCloud</a>, free for open-source projects!</p>

<div id="bin-search-wrapper">
    <ul id="bin-search-filters" class="function-list">
        
        
        
        <li><a href="#+command" data-title="It can be used to break out from restricted environments by running non-interactive system commands.">Command</a></li>
        
        
        
        <li><a href="#+file write" data-title="It writes data to files, it may be used to do privileged writes or write files outside a restricted file system.">File write</a></li>
        
        
        
        <li><a href="#+file read" data-title="It reads data from files, it may be used to do privileged reads or disclose files outside a restricted file system.">File read</a></li>
        
        
        
        <li><a href="#+library load" data-title="It loads shared libraries that may be used to run code in the binary execution context.">Library load</a></li>
        
    </ul>

    <input id="bin-search" type="text" placeholder="Search among 15 binaries: &lt;binary&gt; +&lt;function&gt; ..." />
</div>

<div id="bin-table-wrapper">
    <table id="bin-table">
        <thead>
            <tr>
                <th>Binary</th>
                <th>Functions</th>
            </tr>
        </thead>
        <tbody>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/chrome/" class="bin-name">chrome</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/chrome/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/git-archive/" class="bin-name">git-archive</a></td>
                <td><ul class="function-list">
    
    
    
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/git-archive/#file-write">File write</a></li>
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/git-blame/" class="bin-name">git-blame</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/git-blame/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/git-clone/" class="bin-name">git-clone</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/git-clone/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/git-fetch/" class="bin-name">git-fetch</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/git-fetch/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/git-grep/" class="bin-name">git-grep</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/git-grep/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/git-log/" class="bin-name">git-log</a></td>
                <td><ul class="function-list">
    
    
    
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/git-log/#file-write">File write</a></li>
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/git-ls-remote/" class="bin-name">git-ls-remote</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/git-ls-remote/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/hg/" class="bin-name">hg</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/hg/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/psql/" class="bin-name">psql</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/psql/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/qt5/" class="bin-name">qt5</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/qt5/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/sendmail/" class="bin-name">sendmail</a></td>
                <td><ul class="function-list">
    
    
    
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/sendmail/#file-write">File write</a></li>
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/ssh/" class="bin-name">ssh</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/ssh/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/tar/" class="bin-name">tar</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/tar/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
            <tr>
                <td><a href="/argument-injection-vectors/binaries/zip/" class="bin-name">zip</a></td>
                <td><ul class="function-list">
    
    
    
    
    <li><a href="/argument-injection-vectors/binaries/zip/#command">Command</a></li>
    
    
    
    
    
    
    
    
    
    
</ul>
</td>
            </tr>
            
        </tbody>
        <tfoot>
            <tr><td id="search-message" colspan="2">No binary matches...</td></tr>
        </tfoot>
    </table>
</div>

<script>
 function filter(query) {
     var queryArray = query.toLowerCase().trim().split(/ *\+/);
     var binPattern = queryArray[0];
     var functionPatterns = queryArray.splice(1);

     // filter rows
     var noResults = true;
     document.querySelectorAll('#bin-table tbody tr').forEach(function (row) {
         var show = true;

         var binName = row.children[0].firstElementChild.innerText.toLowerCase();
         if (binName.indexOf(binPattern) === -1) {
             show = false;
         }

         if (show) {
             var functionElems = Array.from(row.children[1].firstElementChild.children);
             functionElems.forEach((item) => {
                 item.className = '';
             });
             functionPatterns.forEach((pattern) => {
                 // skip empty filters
                 if (!pattern) {
                     return;
                 }
                 // check against the pattern
                 var noMatches = true;
                 functionElems.forEach((item) => {
                     if (item.innerText.toLowerCase().startsWith(pattern.toLowerCase())) {
                         item.className = 'match';
                         noMatches = false;
                     }
                 });
                 // no function satisfies the pattern
                 if (noMatches) {
                     show = false;
                 }
             });
         }

         if (show) {
             row.style.display = '';
             noResults = false;
         } else {
             row.style.display = 'none';
         }
     });

     // update the search message visibility
     var searchMessage = document.getElementById('search-message');
     searchMessage.style.display = noResults ? 'table-cell' : 'none';
 }

 function applyFilter() {
     // filter on load according to the URL
     var searchBox = document.getElementById('bin-search');
     var query = decodeURIComponent(location.hash.slice(1));
     filter(query);
     if (query) {
         searchBox.value = query;
     }
 }

 function setup() {
     var searchBox = document.getElementById('bin-search');

     // ensure height during filtering
     var binTableWrapper = document.getElementById('bin-table-wrapper');
     binTableWrapper.style.height = binTableWrapper.clientHeight + 'px';

     // handle user input
     searchBox.addEventListener('input', function () {
         var query = searchBox.value;
         history.replaceState(null, null, encodeURI('#' + query));
         applyFilter();
     });

     // handle shortcuts
     addEventListener('keydown', function (event) {
         // focus search box on valid keydown
         if (event.key.toLowerCase().match(/^[+a-z]$/) &&
             !(event.ctrlKey || event.altKey || event.metaKey)) {
             searchBox.focus();
             searchBox.parentElement.scrollIntoView();
         }
         // clear filter on escape
         else if (event.key === 'Escape') {
             location.hash = searchBox.value = '';
             searchBox.focus();
             searchBox.parentElement.scrollIntoView();
         }
     });

     // handle URL changes
     window.onhashchange = applyFilter;

     // trigger filter on page load
     applyFilter();
 }

 setup();
</script>


        <script>
         // add permalink on headings
         document.querySelectorAll('h2, h3, h4, h5, h5').forEach((heading) => {
             const link = document.createElement('a');
             link.className = 'permalink';
             link.href = `#${heading.id}`;
             heading.appendChild(link);
         });
        </script>
    </body>
</html>